Repository navigation
Clear audit CVEs (urllib3, oauthlib) and run codespell via uv - #1830
Merged
Merged
Conversation
uv audit flags urllib3 2.7.0 (PYSEC-2026-4175/4176/4177, fixed in 2.8.0) and oauthlib 3.3.1 (4 advisories, fixed in 4.0.0). Upgrade only those two packages; both fixed releases are older than the 7-day cooldown. oauthlib is reached only via the dev group (schemasheets -> gspread -> requests-oauthlib), so the major bump does not affect published metadata. Claude-Session: https://claude.ai/code/session_0194GViLfUhoC7CmxXF8eJQe
codespell-project/actions-codespell builds a python:3.13-alpine image on every run, so the check fails whenever Docker Hub rate-limits (429) or its auth endpoint times out (504) -- both hit this PR. Install the locked dev group and run `uv run codespell`, configured by [tool.codespell] in pyproject.toml. This is the same check `make test` and pr-verify-pull-request already run, and drops the action's separate, divergent ignore/skip lists. Claude-Session: https://claude.ai/code/session_0194GViLfUhoC7CmxXF8eJQe
kevinschaper
changed the title
sierra-moxon
approved these changes
Oct 9, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
Audit dependenciesjob (uv audit) has started failing on new advisories. This hits every PR, including #1829, even though they don't touch these packages:urllib32.7.0: PYSEC-2026-4175, -4176, -4177. Fixed in 2.8.0.oauthlib3.3.1: 4 advisories. Fixed in 4.0.0.The codespell check also failed twice on this PR without ever running.
codespell-project/actions-codespellbuilds apython:3.13-alpineDocker image on every run, and Docker Hub returned 429 (rate limit) the first time and 504 (auth timeout) on the re-run.Changes
uv.lock:uv lock --upgrade-package urllib3 --upgrade-package oauthlib. No other resolved versions change, andpyproject.tomlis untouched. Both fixed releases are older than the 7-dayexclude-newercooldown.oauthlib4.0.0 is a major bump, but we only reach it through the dev group (schemasheets→gspread→google-auth-oauthlib→requests-oauthlib). It's not part of the published dependencies, andrequests-oauthlib2.0.0 accepts it..github/workflows/pr-codespell.yaml: replace the Docker action withuv sync --locked --only-dev+uv run --no-sync codespell, configured by[tool.codespell]inpyproject.toml. That's the same checkmake testandpr-verify-pull-requestalready run. It also drops the action's separate ignore/skip lists, which had drifted from thepyproject.tomlconfig.Verification (local)
UV_PREVIEW=1 uv audit: "Found no known vulnerabilities … in 141 packages"make test: 25 passed, linkml-lint clean, codespell cleanhttps://claude.ai/code/session_0194GViLfUhoC7CmxXF8eJQe